[freeswitch-sec] FreeSWITCH selinux policy sponsorship
Hello all, My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going? -- Kristian Kielhofner
Kristian, I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic? /b -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Sep 9, 2013, at 10:10 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
Hello all,
My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going?
-- Kristian Kielhofner
_______________________________________________ freeswitch-sec mailing list freeswitch-sec@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-sec
On Mon, 9 Sep 2013, Brian West wrote:
I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic?
On Sep 9, 2013, at 10:10 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going?
been travelling -- sorry for the delay in reply Hi, Kristian Writing SElinux rules that are durable is tied to getting repeatable packaging together (so that the binaries are predictably in the same places), and talking across the same network ports, etc. As FreeSwitch is somewhat a moving target, and not 'packaged' in a 'major' distribution's main line -- really, RHEL, CentOS or Fedora here -- a set of rules need to be crafted and maintained locally Are you using a packaging such as that from sipXecs / eZuce? If so, I can probably guide you through the ruleset generation. In which FS ML shall we do this? Cross-posting to three is probably rather rude ... fwiw, I've posted pretty sharply to the negative about pelple NOT using SELinux with FreeSwitch [1] in the past -- Russ herrold [1] http://orcorc.blogspot.com/2010/12/ripping-out-safeties.html
Hi Russ, Thanks for your input! As Ken has already said in a separate follow-up I believe FreeSWITCH has matured/settled down enough for formal rules to be included with the source. With that said I'm unfamiliar how SELinux rules are included/added to a given distro (and what SELinux differences there may be in between distros). I certainly understand the desire for integration with distro specific file locations but the vast, vast majority of FreeSWITCH installs are done using the standard layout installed to either /opt/freeswitch or /usr/local/freeswitch. I have no problem developing rules around these locations. Your thoughts? On Thu, Sep 19, 2013 at 2:10 PM, R P Herrold <herrold@owlriver.com> wrote:
On Mon, 9 Sep 2013, Brian West wrote:
I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic?
On Sep 9, 2013, at 10:10 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going?
been travelling -- sorry for the delay in reply
Hi, Kristian
Writing SElinux rules that are durable is tied to getting repeatable packaging together (so that the binaries are predictably in the same places), and talking across the same network ports, etc. As FreeSwitch is somewhat a moving target, and not 'packaged' in a 'major' distribution's main line -- really, RHEL, CentOS or Fedora here -- a set of rules need to be crafted and maintained locally
Are you using a packaging such as that from sipXecs / eZuce? If so, I can probably guide you through the ruleset generation. In which FS ML shall we do this? Cross-posting to three is probably rather rude
... fwiw, I've posted pretty sharply to the negative about pelple NOT using SELinux with FreeSwitch [1] in the past
-- Russ herrold
[1] http://orcorc.blogspot.com/2010/12/ripping-out-safeties.html
-- Kristian Kielhofner
On Thu, 19 Sep 2013, Kristian Kielhofner wrote:
installed to either /opt/freeswitch or /usr/local/freeswitch.
Linux FHS conformance (the 'world' I mostly live in), and recent Red Hat packaging practice would support the first; the second (/use/local) -- not so much Conspicuiously, the freeswitch packaging has not landed in Fedora or EPEL, which are sort of gateways for RH being interested in adding SELinux rulesets Some years ago at a SELinux presentation, I proposed at Ottawa Linux Symposium, and proposals have een floated from time to time to 'bundle' the SELinux rules for a given package within either the .spec file, or as some sort of 'mergable' location per package. Red Hat has chosen to go a different way, where there is a responsive maintainer (Dan Walsh) who seems to have more eyes than a peacock tail, as to SELinux issues on mailing lists Carrying local libraries rather than using system ones as much as possible, is another stumbling block to consider and address I've marked this for some more review after I get the FS SRPMS rebuilding locally -- Russ herrold
On 2013-09-19 18:38, Kristian Kielhofner wrote:
I certainly understand the desire for integration with distro specific file locations but the vast, vast majority of FreeSWITCH installs are done using the standard layout installed to either /opt/freeswitch or /usr/local/freeswitch.
I don't really have strong feelings here, but I'll note that an increasing number of people are installing FS by way of our Debian packages -- we're starting to promote this method -- and those packages install FS per the FHS, e.g. /usr/bin/freeswitch, /var/lib/freeswitch/db, /usr/share/freeswitch/sounds, etc. Ken's RPMs for Redhat/CentOS, as I understand, install FS similarly. For the purposes here, targeting the packaged installs means that, unlike an installation from source, you can be 100% sure where things are going to be located, and because we're following FHS, these locations are exceedingly unlikely to change.
On Thu, Sep 19, 2013 at 3:58 PM, Travis Cross <tc@travislists.com> wrote:
I don't really have strong feelings here, but I'll note that an increasing number of people are installing FS by way of our Debian packages -- we're starting to promote this method -- and those packages install FS per the FHS, e.g. /usr/bin/freeswitch, /var/lib/freeswitch/db, /usr/share/freeswitch/sounds, etc.
Ken's RPMs for Redhat/CentOS, as I understand, install FS similarly.
For the purposes here, targeting the packaged installs means that, unlike an installation from source, you can be 100% sure where things are going to be located, and because we're following FHS, these locations are exceedingly unlikely to change.
Out of curiosity, can you define "increasing"? EIther way I doubt it's hard to create SELinux rules to handle the FHS and "FreeSWITCH" file layouts. -- Kristian Kielhofner
That's what I thought. How should we proceed from here? On Thu, Sep 19, 2013 at 5:25 PM, R P Herrold <herrold@owlriver.com> wrote:
On Thu, 19 Sep 2013, Kristian Kielhofner wrote:
EIther way I doubt it's hard to create SELinux rules to handle the FHS and "FreeSWITCH" file layouts.
the files, no -- the full gamut of potential network socket and database connections, yes
-- Russ herrold
-- Kristian Kielhofner
On 2013-09-19 20:56, Kristian Kielhofner wrote:
Out of curiosity, can you define "increasing"?
My means of measurement are imprecise -- Ken might have better detail from the CDN stats, though that only counts part of it. I'm judging based on the quantity of questions I've been getting about the packaging, that other FS contributors now seem to care if their new module gets added to Debian quickly, and the speed that people notice when Ken's FS.org debian repo breaks.
participants (4)
-
Brian West
-
Kristian Kielhofner
-
R P Herrold
-
Travis Cross